{"id":"EUVD-2026-61101","enisaUuid":"48eb9f86-abe0-3f0e-8e34-25ffb2bb3f14","description":"OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.","datePublished":"Aug 18, 2026, 6:04:42 PM","dateUpdated":"Aug 18, 2026, 6:47:07 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4\nhttps://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a\nhttps://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4\n","aliases":"CVE-2026-69160\n","assigner":"GitHub_M","epss":0.4,"enisaIdProduct":[{"id":"9fb8d480-e7bb-35a4-b841-70bfd3fd9efb","product":{"name":"OpenList","vendor":{"name":"OpenListTeam"}},"product_version":"\u003c 4.2.4"}],"enisaIdVendor":[{"id":"3d8cdbb5-93ff-3a5e-825b-274a4bd9bc1e","vendor":{"name":"OpenListTeam"}}],"enisaIdVulnerability":[{"id":"3ccd2ccf-b829-35e3-b0f1-428da50ea293","vulnerability":{"id":"CVE-2026-69160","description":"OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.","datePublished":"Aug 18, 2026, 6:04:42 PM","dateUpdated":"Aug 18, 2026, 6:47:07 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4\nhttps://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a\nhttps://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4\n","enisa_id":"EUVD-2026-61101\n","assigner":"GitHub_M","epss":0.4,"dataProcessed":"Oct 28, 2026, 7:15:52 AM","vulnerabilityProduct":[{"id":"3d90e539-4acb-341f-aeb9-0ac11280b104","product":{"name":"OpenList","vendor":{"name":"OpenListTeam"}},"product_version":"\u003c 4.2.4"}],"vulnerabilityVendor":[{"id":"91523ced-b3c0-3c4f-8b4d-51a27ede14d3","vendor":{"name":"OpenListTeam"}}]}}],"enisaIdAdvisory":[]}